5 ms·

So, install and use ufw or another simple filtering tool or iptables directly. I'm no expert in Wireguard other than setting it up for personal use at home, so

So, install and use ufw or another simple filtering tool or iptables directly. I'm no expert in Wireguard other than setting it up for personal use at home, so don't quite know more advanced configurations, but this seems like a separate issue relatively easily handled. That said, for my own use case, I wouldn't want to restrict IPs beyond maybe nation restrictions as I expect to connect from untrusted locations.

linuxdude314 2y ago
Agreed this ask makes no sense to me. It sounds like they want the system to somehow know which IP is supposed to be associated with a particular key. You already can restrict public IPs using iptables…
- kstrauser 2y ago
  That actually sounds kind of useful. The firewall doesn’t know about keys. It might be handy to say “this key can only ever connect from this IP”, like when setting up links between fixed business systems. If you know a key can never be legitimately used from any other IP in the world, why not add defense in depth? I wouldn’t lose sleep over not having that. It’d be a nice bonus though.
Spivak 2y ago
This doesn't work because you don't want every peer to be ip-range locked, you want this peer to be ip-range locked. Say you have a WG server on a VPS that your laptop and your Plex server connect to. Your laptop should be allowed to connect anywhere, but you should be suspicious if your Plex server connects from anywhere other than your home address. You're probably familiar with this feature if you've ever used MySQL, users have a username and host spec.